evtsys to syslog for windows events

[coreyf311]

collecting windows logs using evtsys and forwarding to a syslog server. I have a UF installed on the universal forwarder reading the windows logs created by evtsys. I have tried using sourcetype=WinEventLog:Security but the logs do not match what I see in the samples directory from the Splunk_TA_windows apps so these events are not extracted per the app. Is there a TA or sourcetype i can use to get evtsys logs parsed correclty? trying to avoid a custom props/transforms from scratch to parse all this data.

[efika]

Did you manage to find a solution other than writing your own props/transforms ?

[FrankVl]

Can you perhaps share a few sample logs, for those of us not familiar with evtsys? Perhaps someone recognizes it as a format that is supported by some Splunk add-on or one of the sourcetypes supported by Splunk TA Windows (perhaps it looks like snare logs?).